Certificate (TLS certificate): what it is and how it is attacked
A digital document proving something is genuinely what it claims to be.
Also known as
- TLS certificate
- PKI
- code signing certificate
Typing any of them into the editor finds this object.
Why it matters on a security diagram
Software and browsers accept it without asking a person, so a stolen one lets hostile code arrive looking legitimate.
How it gets attacked, and what reduces it
How it gets attacked
- Signing certificates stolen and used to sign malicious software
- Certificates issued by an authority that was tricked into vouching for the wrong party
What reduces it
- Keep signing keys in protected hardware, not beside the code that uses them
- Monitor expiry so an outage is never resolved by turning checks off
- Watch certificate transparency logs for certificates issued in your name that you did not request
Where it sits
- Group
- Identity · Who something claims to be, and what proves it.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- certificate
Reviewed . CC BY 4.0.
Others in identity
- Sign-in serviceIdP · SSO · identity provider · Entra ID · OktaThe single service that proves who someone is, for every application.
- Directory serviceActive Directory · AD · DC · LDAP · domain controller · staff directory · identity storeThe system that holds every account and computer, and decides what each one is allowed to do.
- Second factorMFA · 2FA · multi-factor authenticationA second proof of identity beyond the password.
- Machine accountservice account · robot account · non-human account · application accountAn account used by software rather than by a person.
- Access badgeproximity card · prox card · RFID card · fob · smart card · staff passThe card or fob a person holds against a reader to open a door.
The identity group lists all 6 of them side by side.
Certificate on your own diagram
Open the editor, press N, and type TLS certificate. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker